Teng Wil Liam, Salam Iftekhar, Yau Wei-Chuen, Pieprzyk Josef, Phan Raphaël C-W
School of Computing and Data Science, Xiamen University Malaysia, Sepang, 43900, Malaysia.
Data61, Commonwealth Scientific and Industrial Research Organisation, Marsfield, NSW, 2122, Australia.
Sci Rep. 2022 Mar 29;12(1):5317. doi: 10.1038/s41598-022-09004-3.
Lightweight cryptography has recently gained importance as the number of Internet of things (IoT) devices connected to Internet grows. Its main goal is to provide cryptographic algorithms that can be run efficiently in resource-limited environments such as IoT. To meet the challenge, the National Institute of Standards and Technology (NIST) announced the Lightweight Cryptography (LWC) project. One of the finalists of the project is the TinyJAMBU cipher. This work evaluates the security of the cipher. The tool used for the evaluation is the cube attack. We present five distinguishing attacks DA1-DA5 and two key recovery attacks KRA1-KRA2. The first two distinguishing attacks (DA1 and DA2) are launched against the initialisation phase of the cipher. The best result achieved for the attacks is a distinguisher for an 18-bit cube, where the cipher variant consists of the full initialisation phase together with 438 rounds of the encryption phase. The key recovery attacks (KRA1 and KRA2) are also launched against the initialisation phase of the cipher. The best key recovery attack can be applied for a cipher variant that consists of the full initialisation phase together with 428 rounds of the encryption phase. The attacks DA3-DA5 present a collection of distinguishers up to 437 encryption rounds, whose 32-bit cubes are chosen from the plaintext, nonce, or associated data bits. The results are confirmed experimentally. A conclusion from the work is that TinyJAMBU has a better security margin against cube attacks than claimed by the designers.
随着连接到互联网的物联网（IoT）设备数量的增加，轻量级密码学最近变得越来越重要。其主要目标是提供能够在诸如物联网等资源受限环境中高效运行的加密算法。为应对这一挑战，美国国家标准与技术研究院（NIST）宣布了轻量级密码学（LWC）项目。该项目的决赛入围者之一是TinyJAMBU密码。这项工作评估了该密码的安全性。用于评估的工具是立方攻击。我们提出了五种区分攻击DA1 - DA5和两种密钥恢复攻击KRA1 - KRA2。前两种区分攻击（DA1和DA2）是针对该密码的初始化阶段发起的。这些攻击取得的最佳结果是一个针对18位立方的区分器，其中密码变体包括完整的初始化阶段以及438轮加密阶段。密钥恢复攻击（KRA1和KRA2）也是针对该密码的初始化阶段发起的。最佳的密钥恢复攻击可应用于一个密码变体，该变体包括完整的初始化阶段以及428轮加密阶段。攻击DA3 - DA5展示了一系列多达437轮加密的区分器，其32位立方是从明文、初始向量或关联数据位中选取的。实验结果证实了这些结果。这项工作得出的一个结论是，TinyJAMBU在抵御立方攻击方面具有比设计者声称的更好的安全边际。
